Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 10:20
Static task
static1
Behavioral task
behavioral1
Sample
620e6d15b2e4e0757b7416db231cc2cca2fba125f4c028f67a11d95abcb6813a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
620e6d15b2e4e0757b7416db231cc2cca2fba125f4c028f67a11d95abcb6813a.exe
Resource
win10v2004-20240226-en
General
-
Target
620e6d15b2e4e0757b7416db231cc2cca2fba125f4c028f67a11d95abcb6813a.exe
-
Size
14KB
-
MD5
d02e27bacb24f22550e8739e7d71cc25
-
SHA1
487d1868a36036c0f66da2c9f11e0d2f3307f983
-
SHA256
620e6d15b2e4e0757b7416db231cc2cca2fba125f4c028f67a11d95abcb6813a
-
SHA512
f997e48e027a24a181a0463c506b5b6177911ecc9c0d0a8042453febcf16c164edf4fbb800649451d295313008c2a41f9b8daa84a316899b63bd99ffc7f94ae0
-
SSDEEP
192:f3mbPYCfMcrfOIuZmvKQxtzlSIVX6NOGmejDMN1:uMCfrfQ6tBSI0meUN1
Malware Config
Extracted
metasploit
windows/download_exec
http://162.14.105.213:41231/5kIs
- headers User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; .NET CLR 2.0.50727)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Processes
-
C:\Users\Admin\AppData\Local\Temp\620e6d15b2e4e0757b7416db231cc2cca2fba125f4c028f67a11d95abcb6813a.exe"C:\Users\Admin\AppData\Local\Temp\620e6d15b2e4e0757b7416db231cc2cca2fba125f4c028f67a11d95abcb6813a.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵